Analyze SSH auth logs to detect brute force attack patterns
Analyze Apache access logs for web application attacks
Analyze Windows Event Logs for lateral movement indicators
Analyze firewall/proxy logs to identify DDoS attack patterns
340 failed SSH logins at 3am look like brute force. The change log tells a different story.
The same account logs in from two cities 9,300km apart, twelve minutes apart.
A Kerberos ticket with a 10-year lifetime shows up on a domain with a 10-hour policy.
Response times collapse under load, but bandwidth and CPU both look completely normal.
41,000 failed logins, but none of the usual brute-force fingerprints are anywhere in the log.
A breach investigation needs a 45-day-old VPN log. The retention policy only guarantees 30.